Researchers have detailed a supply-chain campaign where a fake Web3 accelerator, REF8801, distributed malicious npm packages (@apexacc/cli and @apexacc/audit).
Disguised as developer tools and free AI credits, the packages deployed Windows stealers and the CloudSyncD macOS backdoor.
The team managed to build a credibility profile by appearing at major tech conferences, such as TOKEN2049 in Singapore. It promised grants and funding of up to $235.000, while enticing people with free credits for popular AI tools, programming tools, and security audits.
How computers were infected
According to security researchers, the group distributed the malicious material through well-known code sharing platforms for developers, using packages such as @apexacc/cli, @apexacc/audit, as well as older packages that had been detected by researchers since the summer.
When developers downloaded these packages believing they would get the promised tools, their devices were infected depending on the operating system:
READ ALSO
Bankruptcy for Character.AI as part of Disney's acquisition of its executives
- On Windows computers: A program was installed that collected personal data, passwords, files, and data from digital cryptocurrency wallets, sending the stolen data to the perpetrators via a messaging app.
- On Mac computers: It installed a program that displayed a fake authorization window, tricking the user into entering their computer's login password, thus gaining access to the device.
Monitoring communications and artificial intelligence services
In addition to intercepting personal data, the fake tools had the ability to monitor and redirect communication with artificial intelligence services, allowing the perpetrators to view conversations, source code, and sensitive data exchanged between users.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)